ForgeFed - software bill of materials
=====================================

## Specification

The spec is released to the public domain using CC0, and the Markdown source is
rendered to HTML using [Pandoc](https://pandoc.org).

Source repo: <https://notabug.org/peers/forgefed>

Website with rendered HTML: <https://forgefed.peers.community>

## Pagure

An existing forge written in [Python](https://www.python.org), that zPlus will
be patching.

Source repo, hosted using Pagure itself: <https://pagure.io/pagure>

License: GPL 2

Dependencies probably needed (used these with mcfi/cliff):

- httpsig: MIT
- PyCryptodome: "The source code in PyCryptodome is partially in the public
  domain and partially released under the BSD 2-Clause license."
- python requests: Apache License 2.0
- simplejson: MIT + Academic Free License v. 2.1 <- This might not be GPL
  compatible

## Vervis

A forge written by fr33domlover, and used as a reference implementation of
ForgeFed.

[Yesod](https://yesodweb.com) web application written in
[Haskell](https://www.haskell.org). Most source code is in the public domain
under CC0. A few files are BSD or MIT since they have code copied from
elsewhere. The license of the whole web app is AGPL3.

Source repo, hosted using Vervis itself:
<https://dev.angeley.es/s/fr33domlover/r/vervis> (it's a
[Darcs](http://darcs.net) repo, can be cloned using `darcs clone`)

The dependency packages of Vervis:

- The file
  [stack.yaml](https://dev.angeley.es/s/fr33domlover/r/vervis/s/stack.yaml)
  lists under `extra-deps` the dependencies that have custom
  locations/versions.  Dependencies coming from Git repos have their URL listed
  there. Dependencies coming from Darcs repos are listed as relative paths, and
  their URLs are listed in the
  [update-deps.sh](https://dev.angeley.es/s/fr33domlover/r/vervis/s/update-deps.sh)
  script
- All other dependencies are packages from
  [Hackage](https://hackage.haskell.org)
